Upgrade Node.js version to 24.

This requires creating a new major-version (v4) of codeql-action.

.github/actions/check-sarif/action.yml

@@ -16,5 +16,5 @@ inputs:
       Comma separated list of query ids that should NOT be included in this SARIF file.
 
 runs:
-  using: node20
+  using: node24
   main: index.js

.github/workflows/pr-checks.yml

@@ -72,7 +72,7 @@ jobs:
         run: npm run lint-ci
 
       - name: Upload sarif
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: matrix.os == 'ubuntu-latest'
         with:
           sarif_file: eslint.sarif

CONTRIBUTING.md

@@ -13,7 +13,7 @@ Please note that this project is released with a [Contributor Code of Conduct][c
 
 ## Development and Testing
 
-Before you start, ensure that you have a recent version of node (16 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
 
 ### Common tasks
 

README.md

@@ -62,7 +62,8 @@ For compiled languages:
 
 The following versions of the CodeQL Action are currently supported:
 
-- v3 (latest)
+- v3
+- v4 (latest)
 
 ## Supported versions of the CodeQL Bundle on GitHub Enterprise Server
 

analyze/action.yml

@@ -92,6 +92,6 @@ outputs:
   sarif-id:
     description: The ID of the uploaded SARIF file.
 runs:
-  using: node20
+  using: node24
   main: "../lib/analyze-action.js"
   post: "../lib/analyze-action-post.js"

autobuild/action.yml

@@ -15,5 +15,5 @@ inputs:
       $GITHUB_WORKSPACE as its working directory.
     required: false
 runs:
-  using: node20
+  using: node24
   main: '../lib/autobuild-action.js'

build.mjs

@@ -68,7 +68,7 @@ const context = await esbuild.context({
   outdir: OUT_DIR,
   platform: "node",
   plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
-  target: ["node20"],
+  target: ["node24"],
 });
 
 await context.rebuild();

init/action.yml

@@ -165,6 +165,6 @@ outputs:
   codeql-version:
     description: The version of the CodeQL binary used for analysis
 runs:
-  using: node20
+  using: node24
   main: '../lib/init-action.js'
   post: '../lib/init-action-post.js'

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "3.30.6",
+  "version": "4.30.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "3.30.6",
+      "version": "4.30.6",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^2.3.1",
@@ -47,7 +47,7 @@
         "@types/console-log-level": "^1.4.5",
         "@types/follow-redirects": "^1.14.4",
         "@types/js-yaml": "^4.0.9",
-        "@types/node": "20.19.9",
+        "@types/node": "^24.5.2",
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
@@ -2660,13 +2660,13 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "20.19.9",
+      "version": "24.6.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.9.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.6.0.tgz",
-      "integrity": "sha512-cuVNgarYWZqxRJDQHEB58GEONhOK79QVR/qYx4S7kcUObQvUwvFnYxJuuHUKm2aieN9X3yZB4LZsuYNU1Qphsw==",
+      "integrity": "sha512-F1CBxgqwOMc4GKJ7eY22hWhBVQuMYTtqI8L0FcszYcpYX0fzfDGpez22Xau8Mgm7O9fI+zA/TYIdq3tGWfweBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~6.21.0"
+        "undici-types": "~7.13.0"
       }
     },
     "node_modules/@types/node-forge": {
@@ -4200,9 +4200,7 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
+      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -9197,9 +9195,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "6.21.0",
+      "version": "7.13.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.13.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "integrity": "sha512-Ov2Rr9Sx+fRgagJ5AX0qvItZG/JKKoBRAVITs1zk7IqZGTJUwgUr7qoYBpWwakpWilTZFM98rG/AFRocu10iIQ==",
       "dev": true,
       "license": "MIT"
     },

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.30.6",
+  "version": "4.30.6",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -62,7 +62,7 @@
     "@types/console-log-level": "^1.4.5",
     "@types/follow-redirects": "^1.14.4",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "20.19.9",
+    "@types/node": "^24.5.2",
     "@types/node-forge": "^1.3.14",
     "@types/semver": "^7.7.1",
     "@types/sinon": "^17.0.4",

resolve-environment/action.yml

@@ -21,5 +21,5 @@ outputs:
   environment:
     description: The inferred build environment configuration.
 runs:
-  using: node20
+  using: node24
   main: '../lib/resolve-environment-action.js'

src/autobuild.ts

@@ -52,11 +52,11 @@ export async function determineAutobuildLanguages(
    * For example, consider a user with the following workflow file:
    *
    * ```yml
-   * - uses: github/codeql-action/init@v3
+   * - uses: github/codeql-action/init@v4
    *   with:
    *     languages: go, java
-   * - uses: github/codeql-action/autobuild@v3
+   * - uses: github/codeql-action/autobuild@v4
-   * - uses: github/codeql-action/analyze@v3
+   * - uses: github/codeql-action/analyze@v4
    * ```
    *
    * - With Go extraction disabled, we will run the Java autobuilder in the

src/init-action-post-helper.test.ts

@@ -84,14 +84,14 @@ test("uploads failed SARIF run with `diagnostics export` if feature flag is off"
     },
     {
       name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
       with: {
         languages: "javascript",
       },
     },
     {
       name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
       with: {
         category: "my-category",
       },
@@ -108,14 +108,14 @@ test("uploads failed SARIF run with `diagnostics export` if the database doesn't
     },
     {
       name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
       with: {
         languages: "javascript",
       },
     },
     {
       name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
       with: {
         category: "my-category",
       },
@@ -135,14 +135,14 @@ test("uploads failed SARIF run with database export-diagnostics if the database
     },
     {
       name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
       with: {
         languages: "javascript",
       },
     },
     {
       name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
       with: {
         category: "my-category",
       },
@@ -192,14 +192,14 @@ for (const { uploadInput, shouldUpload } of UPLOAD_INPUT_TEST_CASES) {
       },
       {
         name: "Initialize CodeQL",
-        uses: "github/codeql-action/init@v3",
+        uses: "github/codeql-action/init@v4",
         with: {
           languages: "javascript",
         },
       },
       {
         name: "Perform CodeQL Analysis",
-        uses: "github/codeql-action/analyze@v3",
+        uses: "github/codeql-action/analyze@v4",
         with: {
           category: "my-category",
           upload: uploadInput,
@@ -227,14 +227,14 @@ test("uploading failed SARIF run succeeds when workflow uses an input with a mat
     },
     {
       name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
       with: {
         languages: "javascript",
       },
     },
     {
       name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
       with: {
         category: "/language:${{ matrix.language }}",
       },
@@ -254,14 +254,14 @@ test("uploading failed SARIF run fails when workflow uses a complex upload input
     },
     {
       name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
       with: {
         languages: "javascript",
       },
     },
     {
       name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
       with: {
         upload: "${{ matrix.language != 'csharp' }}",
       },

src/workflow.test.ts

@@ -395,9 +395,9 @@ async function testLanguageAliases(
             },
           },
           steps: [
-            { uses: "actions/checkout@v3" },
+            { uses: "actions/checkout@v4" },
-            { uses: "github/codeql-action/init@v3" },
+            { uses: "github/codeql-action/init@v4" },
-            { uses: "github/codeql-action/analyze@v3" },
+            { uses: "github/codeql-action/analyze@v4" },
           ],
         },
       },
@@ -666,7 +666,7 @@ test("getWorkflowErrors() should report a warning if different versions of the C
         analyze:
           steps:
             - uses: github/codeql-action/init@v2
-            - uses: github/codeql-action/analyze@v3
+            - uses: github/codeql-action/analyze@v4
     `) as Workflow,
     await getCodeQLForTesting(),
   );
@@ -686,8 +686,8 @@ test("getWorkflowErrors() should not report a warning if the same versions of th
       jobs:
         analyze:
           steps:
-            - uses: github/codeql-action/init@v3
+            - uses: github/codeql-action/init@v4
-            - uses: github/codeql-action/analyze@v3
+            - uses: github/codeql-action/analyze@v4
     `) as Workflow,
     await getCodeQLForTesting(),
   );
@@ -706,7 +706,7 @@ test("getWorkflowErrors() should not report a warning involving versions of othe
         analyze:
           steps:
             - uses: actions/checkout@v5
-            - uses: github/codeql-action/init@v3
+            - uses: github/codeql-action/init@v4
     `) as Workflow,
     await getCodeQLForTesting(),
   );
@@ -723,9 +723,9 @@ test("getCategoryInputOrThrow returns category for simple workflow with category
           analysis:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/checkout@v3
+              - uses: actions/checkout@v4
-              - uses: github/codeql-action/init@v3
+              - uses: github/codeql-action/init@v4
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                 with:
                   category: some-category
       `) as Workflow,
@@ -745,9 +745,9 @@ test("getCategoryInputOrThrow returns undefined for simple workflow without cate
           analysis:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/checkout@v3
+              - uses: actions/checkout@v4
-              - uses: github/codeql-action/init@v3
+              - uses: github/codeql-action/init@v4
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
       `) as Workflow,
       "analysis",
       {},
@@ -765,19 +765,19 @@ test("getCategoryInputOrThrow returns category for workflow with multiple jobs",
           foo:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/checkout@v3
+              - uses: actions/checkout@v4
-              - uses: github/codeql-action/init@v3
+              - uses: github/codeql-action/init@v4
               - runs: ./build foo
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                 with:
                   category: foo-category
           bar:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/checkout@v3
+              - uses: actions/checkout@v4
-              - uses: github/codeql-action/init@v3
+              - uses: github/codeql-action/init@v4
               - runs: ./build bar
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                 with:
                   category: bar-category
       `) as Workflow,
@@ -800,11 +800,11 @@ test("getCategoryInputOrThrow finds category for workflow with language matrix",
               matrix:
                 language: [javascript, python]
             steps:
-              - uses: actions/checkout@v3
+              - uses: actions/checkout@v4
-              - uses: github/codeql-action/init@v3
+              - uses: github/codeql-action/init@v4
                 with:
                   language: \${{ matrix.language }}
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                 with:
                   category: "/language:\${{ matrix.language }}"
       `) as Workflow,
@@ -824,9 +824,9 @@ test("getCategoryInputOrThrow throws error for workflow with dynamic category",
           jobs:
             analysis:
               steps:
-                - uses: actions/checkout@v3
+                - uses: actions/checkout@v4
-                - uses: github/codeql-action/init@v3
+                - uses: github/codeql-action/init@v4
-                - uses: github/codeql-action/analyze@v3
+                - uses: github/codeql-action/analyze@v4
                   with:
                     category: "\${{ github.workflow }}"
         `) as Workflow,
@@ -851,12 +851,12 @@ test("getCategoryInputOrThrow throws error for workflow with multiple calls to a
             analysis:
               runs-on: ubuntu-latest
               steps:
-                - uses: actions/checkout@v3
+                - uses: actions/checkout@v4
-                - uses: github/codeql-action/init@v3
+                - uses: github/codeql-action/init@v4
-                - uses: github/codeql-action/analyze@v3
+                - uses: github/codeql-action/analyze@v4
                   with:
                     category: some-category
-                - uses: github/codeql-action/analyze@v3
+                - uses: github/codeql-action/analyze@v4
                   with:
                     category: another-category
         `) as Workflow,

start-proxy/action.yml

@@ -26,6 +26,6 @@ outputs:
   proxy_urls:
     description: A stringified JSON array of objects containing the types and URLs of the configured registries.
 runs:
-  using: node20
+  using: node24
   main: "../lib/start-proxy-action.js"
   post: "../lib/start-proxy-action-post.js"

upload-sarif/action.yml

@@ -41,6 +41,6 @@ outputs:
 
       { "code-scanning": "some-id", "code-quality": "some-other-id" }
 runs:
-  using: node20
+  using: node24
   main: '../lib/upload-sarif-action.js'
   post: '../lib/upload-sarif-action-post.js'